Use LOAD_VERIFY_EV_CERT to verify EV-ness in Verify()....

net/base/x509_certificate_nss.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 // Work around https://bugzilla.mozilla.org/show_bug.cgi?id=455424
 // until NSS 3.12.2 comes out and we update to it.
 #define Lock FOO_NSS_Lock
 #include <cert.h>
@@ skipping 353 matching lines @@
   if (dns_names->empty())
     dns_names->push_back(subject_.common_name);
 }
 
 // TODO(ukai): fix to use this method to verify certificate on SSL channel.
 // Note that it's not being used yet.  We need to fix SSLClientSocketNSS to
 // use this method to verify ssl certificate.
 // The problem is that we get segfault when unit tests is going to terminate
 // if PR_Cleanup is called in NSSInitSingleton destructor.
 int X509Certificate::Verify(const std::string& hostname,
-                            bool rev_checking_enabled,
+                            int flags,
                             CertVerifyResult* verify_result) const {
   verify_result->Reset();
 
   // Make sure that the hostname matches with the common name of the cert.
   SECStatus status = CERT_VerifyCertName(cert_handle_, hostname.c_str());
   if (status != SECSuccess)
     verify_result->cert_status |= CERT_STATUS_COMMON_NAME_INVALID;
 
   // Make sure that the cert is valid now.
   SECCertTimeValidity validity = CERT_CheckCertValidTimes(
       cert_handle_, PR_Now(), PR_TRUE);
   if (validity != secCertTimeValid)
     verify_result->cert_status |= CERT_STATUS_DATE_INVALID;
 
   CERTRevocationFlags revocation_flags;
   // TODO(ukai): Fix to use OCSP.
   // OCSP mode would fail with SEC_ERROR_UNKNOWN_ISSUER.
   // We need to set up OCSP and install an HTTP client for NSS.
   bool use_ocsp = false;
+  // EV requires revocation checking.
+  if (!(flags & VERIFY_REV_CHECKING_ENABLED))
+    flags &= ~VERIFY_EV_CERT;
 
   // TODO(wtc): Use CERT_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE and
   // CERT_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE for EV certificate
   // verification.
   PRUint64 revocation_method_flags =
       CERT_REV_M_TEST_USING_THIS_METHOD |
       CERT_REV_M_ALLOW_NETWORK_FETCHING |
       CERT_REV_M_ALLOW_IMPLICIT_DEFAULT_SOURCE |
       CERT_REV_M_SKIP_TEST_ON_MISSING_SOURCE |
       CERT_REV_M_STOP_TESTING_ON_FRESH_INFO;
@@ skipping 66 matching lines @@
         (verify_result->cert_status & CERT_STATUS_DATE_INVALID) != 0)
       err = SEC_ERROR_EXPIRED_CERTIFICATE;
     verify_result->cert_status |= MapCertErrorToCertStatus(err);
     return MapCertStatusToNetError(verify_result->cert_status);
   }
 
   GetCertChainInfo(cvout[cvout_cert_list_index].value.pointer.chain,
                    verify_result);
   if (IsCertStatusError(verify_result->cert_status))
     return MapCertStatusToNetError(verify_result->cert_status);
+  if ((flags & VERIFY_EV_CERT) && VerifyEV())
+    verify_result->cert_status |= CERT_STATUS_IS_EV;
   return OK;
 }
 
 // TODO(port): Implement properly on Linux.
-bool X509Certificate::IsEV(int status) const {
+bool X509Certificate::VerifyEV() const {
   NOTIMPLEMENTED();
   return false;
 }
 
 // static
 X509Certificate::OSCertHandle X509Certificate::CreateOSCertHandleFromBytes(
     const char* data, int length) {
   base::EnsureNSSInit();
 
   SECItem der_cert;
@@ skipping 18 matching lines @@
   DCHECK(0 != cert->derCert.len);
 
   SECStatus rv = HASH_HashBuf(HASH_AlgSHA1, sha1.data,
                               cert->derCert.data, cert->derCert.len);
   DCHECK(rv == SECSuccess);
 
   return sha1;
 }
 
 }  // namespace net